Hi,

The following vulnerability was published for sssd.

CVE-2026-90995[0]:
| A flaw was found in SSSD (System Security Services Daemon). A local
| attacker with privileges to connect to the PAM (Pluggable
| Authentication Modules) responder socket can send a specially
| crafted protocol request. If the `pam_app_services` configuration is
| enabled and the service item is omitted from the request, a NULL
| pointer dereference can occur. This vulnerability leads to a denial
| of service, causing the PAM responder to crash and disrupt
| authentication services.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-90995
https://www.cve.org/CVERecord?id=CVE-2026-90995
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2479464

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore